Your data, on your machine
This Privacy Policy governs the collection, handling, storage, and sharing of information across KasyHQ products, including the 'ReturnPilot — GST Return Assistant' Chrome Extension (ID: aonckbcabfdbpamocmihkfcjnpoacbbe), 'ReturnPilot — TDS Challan Downloader', 'Vibe Translator', and the kasyhq.com website. Our architecture is built on a strict local-first principle: sensitive data is processed in-memory on your local machine and is never transmitted to or stored on our servers.
Last updated: 10 September 2026
1. Scope & Product Identification
This Privacy Policy applies to all users of KasyHQ web services (kasyhq.com) and browser extensions, specifically 'ReturnPilot — GST Return Assistant' (Chrome Web Store ID: aonckbcabfdbpamocmihkfcjnpoacbbe), 'ReturnPilot — TDS Challan Downloader', and 'Vibe Translator'. ReturnPilot assists taxpayers and professionals in automating official return downloads directly from government portals. Vibe Translator provides conversational vibe translation of public social discussions without harvesting private credentials or personal messages.
2. User Data Collection
We collect and access only the minimum data strictly required to provide extension functionality: • Tax & Financial Data (Processed Locally): GSTIN (Goods and Services Tax Identification Number), taxpayer trade names, return filing periods, and filed return tables (GSTR-1, GSTR-3B, GSTR-2B, GSTR-1A, GSTR-9, GSTR-9C, IMS). This data is accessed solely from the official government portal (https://*.gst.gov.in) while you are logged in and is processed 100% in-memory within your browser runtime. • Account Identification Information (Cloud Stored for Subscriptions): When you sign in via Google OAuth, we receive your email address, display name, and avatar picture from Google Identity Services solely to verify your subscription tier and license validity. • Portal Authentication Credentials (Optional Local Storage): If you explicitly choose to save GST or Income Tax portal credentials for auto-login, they are encrypted locally using AES-GCM / Web Crypto and stored exclusively in your local browser storage (chrome.storage.local). They are NEVER sent to our servers or any third party. • Portal Captcha Images (Ephemeral In-Memory Inference): When you trigger 1-Click AI Captcha Auto-Fill, the temporary portal captcha image is transmitted over encrypted HTTPS to our inference gateway solely to recognize the 6 alphanumeric characters and return the text. Captcha images are processed in-memory in ~50ms, are NEVER stored on disk, never retained in a database, and never used to train external models. • Technical Diagnostics & Error Logs (Operational Reliability): When an unhandled runtime error or portal response parsing failure occurs, the extension may transmit an anonymized technical error stack trace (error message, file/line reference, return type, extension version, and browser version) over encrypted HTTPS solely to troubleshoot and fix software bugs. Error logs never contain passwords, tax figures, invoice records, or personally identifiable information. • Lifecycle & Trial Telemetry: When an extension is installed, uninstalled, or a trial is activated, anonymous lifecycle event markers (timestamp, extension version, trial status, and optional uninstall feedback) are recorded to manage licenses and prevent trial abuse. • Technical & Session Cookies: We access authenticated portal session cookies solely to synchronize sessions across official portal subdomains (e.g. return.gst.gov.in to gstr2b.gst.gov.in) to query return download endpoints on your behalf.
3. User Data Handling & Processing
We handle and use your information strictly for the single disclosed purpose: • Client-Side Automation: Generating and formatting official GST return PDF, Excel, and JSON reports requested by the user. • AI Captcha Resolution: Transmitting distorted portal captcha challenge images to our inference engine to return text strings, subject to daily fair-usage rate limits (50 solves/day trial, 100 solves/day premium) to protect backend infrastructure against automated scraping and misuse. • Subscription Entitlement: Verifying Google account email against our database to grant access to Premium features. • Invoicing: Generating computer-generated commercial payment receipts for subscription purchases. • Operational Reliability: Diagnosing technical error logs and fixing portal layout compatibility bugs. • Customer Support: Answering support requests and resolving issues sent to support@kasyhq.com. Prohibited Uses: We do NOT use, process, or analyze your personal, financial, or tax data for advertising, marketing, profiling, retargeting, analytics tracking, or credit scoring.
4. User Data Storage, Security & Retention
• 100% Local In-Memory Processing: All GST returns, tax calculations, invoice lists, and financial figures are compiled strictly in-memory within your browser. They are NEVER stored on, logged to, or transmitted to any remote cloud server or database. • Local File Downloads: Generated files (PDF, Excel, JSON) are saved directly to your computer's local Downloads folder via the browser's native download manager (chrome.downloads). • Cloud Storage Scope: Only your account email, subscription plan, payment ID, and expiration date are stored in our secure cloud database (Google Firebase Firestore) protected by IAM security rules. • Retention & Purging: Temporary in-memory data is purged immediately when the export task finishes or when the browser tab is closed. You can erase all local data anytime by uninstalling the extension.
5. User Data Sharing & Third-Party Disclosure
We maintain a strict non-disclosure, zero-monetization policy: • Zero Sale of Data: We DO NOT sell, rent, trade, lease, or monetize personal data, tax records, or usage information to third parties, data brokers, or advertisers under any circumstances. • Zero Targeted Advertising: We DO NOT share, transfer, or use user data for advertising, retargeting, interest-based ads, or cross-site tracking. • Zero Creditworthiness Evaluation: We DO NOT use or transfer user data to evaluate creditworthiness or for consumer lending purposes. • Authorized Sub-processors: Data is shared only with essential infrastructure providers bound by confidentiality: Google Firebase (Authentication & License storage), Razorpay (PCI-DSS Level 1 payment gateway in INR), Resend (Transactional invoice emails), Cloudflare (SSL/TLS CDN hosting), and Microsoft Clarity (Anonymous web behavior telemetry and heatmaps with automatic PII masking). • Website Analytics & Telemetry (Microsoft Clarity): To improve website layout and identify broken or confusing interactions, kasyhq.com utilizes Microsoft Clarity. Clarity captures anonymous interaction telemetry (clicks, mouse movements, scrolling, and device type). Clarity sets first-party analytics cookies (_clck, _clsk) to connect pageviews into user sessions. All form inputs, numbers, and passwords are automatically masked before transmission so no personal or financial information is ever captured or stored.
6. Chrome Extension Permissions Justification
Every permission declared in our extension manifest adheres to the Principle of Least Privilege: • activeTab: Interacts with the current GST portal tab when you open the extension popup. • cookies: Synchronizes authenticated session cookies between return.gst.gov.in and gstr2b.gst.gov.in for report generation. • declarativeNetRequestWithHostAccess: Configures required Referer and frame headers on official GST portal subdomains (return.gst.gov.in, gstr2b.gst.gov.in). • downloads: Saves user-requested GST return files (PDF, Excel, JSON) directly to your local downloads folder. • scripting: Injects lightweight export runner forms into background hidden frames on the GST portal. • storage: Stores user UI preferences and licensing status locally. • webNavigation: Verifies that target GST portal pages have fully loaded before initiating report capture.
7. User Rights & Data Deletion Policy
Under applicable data protection laws, you have full control over your information: • Right to Access & Rectification: Access or correct your subscription account details anytime. • Right to Erasure: Request permanent deletion of your account and cloud license records by emailing support@kasyhq.com. Requests are executed within 30 calendar days. • Local Data Cleanup: Erase all local settings immediately by clearing browser extension storage or uninstalling ReturnPilot.
8. Children's Privacy
ReturnPilot is intended exclusively for adult tax professionals, Chartered Accountants, tax practitioners, and business owners. We do not knowingly collect or solicit personal information from children under 18 years of age.
9. Limited Use & Policy Changes
ReturnPilot's use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Any updates to this policy will be posted on this page with an updated timestamp.
10. Contact Information & Developer Details
For questions, privacy inquiries, or data deletion requests, contact our privacy desk: • Developer Entity: KasyHQ • Principal Location: Raipur, Chhattisgarh, India • Developer Email: support@kasyhq.com • Website: https://kasyhq.com • Response Time: Within two business days.
Questions about this policy?
Write to our privacy desk - we reply within two business days.
support@kasyhq.com